========== GLOBAL =========== error log:/usr/local/rejik3/redirector.err change log:/usr/local/rejik3/redirector.log make-cache:/usr/local/rejik3/make-cache allow urls file: none work_ip_count: 0 (flag:0) Allow_ip_count: 0 Work_id_count: 0 (flag:0) Allow_id_count: 0 change_count: 0 Raw change to log: ON Redir counter: 4 =========================== Name: BANNER Dir: /usr/local/rejik3/banlists/banners URL: http://127.0.0.1/ban/1x1.gif Log_flag: 0 (0-on,1-off) revers_flag: 0 (0-on,1-off) work_ip_count: 0 (flag:0) Allow_ip_count: 0 Work_id_count: 0 (flag:0) Allow_id_count: 0 =========================== Name: PORNO Dir: /usr/local/rejik3/banlists/porno URL: http://127.0.0.1/ban/porno.html Log_flag: 0 (0-on,1-off) revers_flag: 0 (0-on,1-off) work_ip_count: 0 (flag:0) Allow_ip_count: 0 Work_id_count: 0 (flag:0) Allow_id_count: 0 =========================== Name: MP3 Dir: /usr/local/rejik3/banlists/mp3 URL: http://127.0.0.1/ban/mp3.html Log_flag: 0 (0-on,1-off) revers_flag: 0 (0-on,1-off) work_ip_count: 0 (flag:0) Allow_ip_count: 0 Work_id_count: 0 (flag:0) Allow_id_count: 0 =========================== Name: JS Dir: /usr/local/rejik3/banlists/js URL: http://127.0.0.1/ban/js.js Log_flag: 0 (0-on,1-off) revers_flag: 0 (0-on,1-off) work_ip_count: 0 (flag:0) Allow_ip_count: 0 Work_id_count: 0 (flag:0) Allow_id_count: 0 lock file: /usr/local/rejik3/banlists/banners/lock.file prepare url: http://127.0.0.1/ban/1x1.gif 0: http://127.0.0.1/ban/1x1.gif TYPE:0 === /usr/local/rejik3/banlists/banners/pcre === .*\.epiccams.com.* .*\/.*cifrovik\.swf\?clickTAG /begun_ 1000ip\.com\/baner_.*\.gif 212\.42\.64\.12\:443\/[0-9]*x[0-9]*\_4\.swf a\.as\-eu\.falkag\.net\/dat\/bgf\/.*[0-9].*x[0-9].*.*\.gif abc\.net\.ru\/baner\/.*\.gif ad2\.regiedepub\.com\/cgi\-bin\/media_online\/main\/mol_ps\.toy.* ad[0-9]\.bigmir\.net\/t\.bbn.* ad\.adriver\.ru\/cgi\-bin\/.*\.cgi\? baner[0-9]\.ukr\.net baner\.ukr\.net\/*.swf bannex\.com\.ua\/cgi\-bin\/get\.cgi\?.* bbnu\.img\.com\.ua\/*\.swf c.bigmir.net/? car4europe.ru/images/banner codenet.ru/bb/nn.* digibucks\.com\/banners\/.*\.gif dist.belnk.com/[0-9]* images\.rambler\.ru/top100/[wb]\d+\.gif images\.rambler\.ru\/.*\/ad\/.*\.gif imageshop\.ru\/bb\/.*\.gif index\.org\.ua\/img\/b_[0-9].*\.gif kindgirls\.com\/banners[0-9]*\/* list\.ru\/img\/buttons\/.*\.gif mc\.com\.ua\/sponsor\/.*\.[gif|jpg] narod\.yandex\.ru\/banners\/[0-9]x[0-9]\-[0-9]\.gif neathosting.gif$ news\.img\.com\.ua\/img\/banners\/.*[0-9]*x[0-9]*\.gif pix.alronix.net/ban r.mail.ru/b rambler.gif$ regiedepub\.com\/media_online\/.*[0-9]*x[0-9]*\.gif te\.net\.ua\/pics\/microban\/.* top.bum.ru/.*/.*gif us\.a[0-9]*\.yimg\.com wallpaperstars\.com\/img\/*banner* win\.mail\.ru\/\cgi\-bin\/banner\?id.* xvx\.ru\/open[0-9].*\.jpg yandex.gif$ zasos\.ru\/FotoBan\/foto.*\/.*\.gif prepare url: http://127.0.0.1/ban/porno.html 0: http://127.0.0.1/ban/porno.html TYPE:0 === /usr/local/rejik3/banlists/porno/pcre === prepare url: http://127.0.0.1/ban/mp3.html 0: http://127.0.0.1/ban/mp3.html TYPE:0 === /usr/local/rejik3/banlists/mp3/pcre === \..+\/.+\.avi([\W_]|$) \..+\/.+\.mid([\W_]|$) \..+\/.+\.mp3([\W_]|$) \..+\/.+\.mpeg([\W_]|$) \..+\/.+\.mpg([\W_]|$) \..+\/.+\.pls([\W_]|$) \..+\/.+\.wav([\W_]|$) \..+\/.+\.wma([\W_]|$) \..+\/.+\.wmv([\W_]|$) ^mms\:\/\/ prepare url: http://127.0.0.1/ban/js.js 0: http://127.0.0.1/ban/js.js TYPE:0 === /usr/local/rejik3/banlists/js/pcre === Open log file: /usr/local/rejik3/redirector.log Parsing input string: http://hit6.hotlog.ru/cgi-bin/hotlog/count?0.041401362225782945&s=156179&im=119&r=http%3A//sm.aport.ru/scripts/template.dll%3FThat%3Dstd%26r%3D%u041C%u044B%u0442%u0438%u0449%u0438&pg=http%3A//www.mytischi.com/&c=Y&j=Y&wh=1024x768&px=16&js=1.3& 10.10.0.35/- - GET url: http://hit6.hotlog.ru/cgi-bin/hotlog/count?0.041401362225782945&s=156179&im=119&r=http%3A//sm.aport.ru/scripts/template.dll%3FThat%3Dstd%26r%3D%u041C%u044B%u0442%u0438%u0449%u0438&pg=http%3A//www.mytischi.com/&c=Y&j=Y&wh=1024x768&px=16&js=1.3& Check url to change: http://hit6.hotlog.ru/cgi-bin/hotlog/count?0.041401362225782945&s=156179&im=119&r=http%3A//sm.aport.ru/scripts/template.dll%3FThat%3Dstd%26r%3D%u041C%u044B%u0442%u0438%u0449%u0438&pg=http%3A//www.mytischi.com/&c=Y&j=Y&wh=1024x768&px=16&js=1.3& url_un: http://hit6.hotlog.ru/cgi-bin/hotlog/count?0.041401362225782945&s=156179&im=119&r=http://sm.aport.ru/scripts/template.dll?That=std&r=%u041C%u044B%u0442%u0438%u0449%u0438&pg=http://www.mytischi.com/&c=Y&j=Y&wh=1024x768&px=16&js=1.3& ip: 10.10.0.35 host: - ident: - ident_u: - method: GET === Parse url: http://hit6.hotlog.ru/cgi-bin/hotlog/count?0.041401362225782945&s=156179&im=119&r=http://sm.aport.ru/scripts/template.dll?That=std&r=%u041C%u044B%u0442%u0438%u0449%u0438&pg=http://www.mytischi.com/&c=Y&j=Y&wh=1024x768&px=16&js=1.3& === protocol: http separator: 21 Symbol:/ (47) dirs: /cgi-bin/hotlog/count?0.041401362225782945&s=156179&im=119&r=http://sm.aport.ru/scripts/template.dll?That=std&r=%u041C%u044B%u0442%u0438%u0449%u0438&pg=http://www.mytischi.com/&c=Y&j=Y&wh=1024x768&px=16&js=1.3& port: none 2levdlomen: hotlog.ru subdomen: hit6 Look for hotlog.ru in (nil) list 2 level domen not found Look for hotlog.ru in 0x8057bdc list 2 level domen found in rule hotlog.ru http://127.0.0.1/ban/1x1.gif 10.10.0.35/- - GET Parsing input string: http://www.google-analytics.com/__utm.gif?utmwv=1&utmn=409209464&utmsr=1024x768&utmsc=16-bit&utmul=ru&utmje=1&utmfl=8.0&utmcn=1&utmdt=NEWSru.com%20%3A%3A%20%u041C%u0443%u0436%u0435%u0441%u0442%u0432%u0435%u043D%u043D%u043E%u0439%20%u043A%u0438%u0442%u0430%u0439%u0441%u043A%u043E%u0439%20%u0444%u0438%u0433%u0443%u0440%u0438%u0441%u0442%u043A%u0435%20%u043F%u0440%u0435%u0434%u043F%u0438%u0441%u0430%u043D%20%u043F%u043E%u0441%u0442%u0435%u043B%u044C%u043D%u044B%u0439%20%u0440%u0435%u0436%u0438%u043C&utmhn=newsru.com&utmr=http://newsnetwork.adfox.ru/getCode?p1=bh&p2=bn&p3=0&p4=a&pr=602437&utmp=/arch/sport/15feb2006/ch_girl.html&utmac=UA-129437-5&utmcc=__utma%3D60665394.286984764.1138012151.1138012151.1140533615.2%3B+__utmb%3D60665394%3B+__utmc%3D60665394%3B+__utmz%3D60665394.1140533615.2.2.utmccn%3D%28referral%29%7Cutmcsr%3Dnewsnetwork.adfox.ru%7Cutmcct%3D/getCode%7Cutmcmd%3Dreferral%3B 10.10.0.58/- - GET url: http://www.google-analytics.com/__utm.gif?utmwv=1&utmn=409209464&utmsr=1024x768&utmsc=16-bit&utmul=ru&utmje=1&utmfl=8.0&utmcn=1&utmdt=NEWSru.com%20%3A%3A%20%u041C%u0443%u0436%u0435%u0441%u0442%u0432%u0435%u043D%u043D%u043E%u0439%20%u043A%u0438%u0442%u0430%u0439%u0441%u043A%u043E%u0439%20%u0444%u0438%u0433%u0443%u0440%u0438%u0441%u0442%u043A%u0435%20%u043F%u0440%u0435%u0434%u043F%u0438%u0441%u0430%u043D%20%u043F%u043E%u0441%u0442%u0435%u043B%u044C%u043D%u044B%u0439%20%u0440%u0435%u0436%u0438%u043C&utmhn=newsru.com&utmr=http://newsnetwork.adfox.ru/getCode?p1=bh&p2=bn&p3=0&p4=a&pr=602437&utmp=/arch/sport/15feb2006/ch_girl.html&utmac=UA-129437-5&utmcc=__utma%3D60665394.286984764.1138012151.1138012151.1140533615.2%3B+__utmb%3D60665394%3B+__utmc%3D60665394%3B+__utmz%3D60665394.1140533615.2.2.utmccn%3D%28referral%29%7Cutmcsr%3Dnewsnetwork.adfox.ru%7Cutmcct%3D/getCode%7Cutmcmd%3Dreferral%3B Check url to change: http://www.google-analytics.com/__utm.gif?utmwv=1&utmn=409209464&utmsr=1024x768&utmsc=16-bit&utmul=ru&utmje=1&utmfl=8.0&utmcn=1&utmdt=NEWSru.com%20%3A%3A%20%u041C%u0443%u0436%u0435%u0441%u0442%u0432%u0435%u043D%u043D%u043E%u0439%20%u043A%u0438%u0442%u0430%u0439%u0441%u043A%u043E%u0439%20%u0444%u0438%u0433%u0443%u0440%u0438%u0441%u0442%u043A%u0435%20%u043F%u0440%u0435%u0434%u043F%u0438%u0441%u0430%u043D%20%u043F%u043E%u0441%u0442%u0435%u043B%u044C%u043D%u044B%u0439%20%u0440%u0435%u0436%u0438%u043C&utmhn=newsru.com&utmr=http://newsnetwork.adfox.ru/getCode?p1=bh&p2=bn&p3=0&p4=a&pr=602437&utmp=/arch/sport/15feb2006/ch_girl.html&utmac=UA-129437-5&utmcc=__utma%3D60665394.286984764.1138012151.1138012151.1140533615.2%3B+__utmb%3D60665394%3B+__utmc%3D60665394%3B+__utmz%3D60665394.1140533615.2.2.utmccn%3D%28referral%29%7Cutmcsr%3Dnewsnetwork.adfox.ru%7Cutmcct%3D/getCode%7Cutmcmd%3Dreferral%3B url_un: http://www.google-analytics.com/__utm.gif?utmwv=1&utmn=409209464&utmsr=1024x768&utmsc=16-bit&utmul=ru&utmje=1&utmfl=8.0&utmcn=1&utmdt=NEWSru.com :: %u041C%u0443%u0436%u0435%u0441%u0442%u0432%u0435%u043D%u043D%u043E%u0439 %u043A%u0438%u0442%u0430%u0439%u0441%u043A%u043E%u0439 %u0444%u0438%u0433%u0443%u0440%u0438%u0441%u0442%u043A%u0435 %u043F%u0440%u0435%u0434%u043F%u0438%u0441%u0430%u043D %u043F%u043E%u0441%u0442%u0435%u043B%u044C%u043D%u044B%u0439 %u0440%u0435%u0436%u0438%u043C&utmhn=newsru.com&utmr=http://newsnetwork.adfox.ru/getCode?p1=bh&p2=bn&p3=0&p4=a&pr=602437&utmp=/arch/sport/15feb2006/ch_girl.html&utmac=UA-129437-5&utmcc=__utma=60665394.286984764.1138012151.1138012151.1140533615.2;+__utmb=60665394;+__utmc=60665394;+__utmz=60665394.1140533615.2.2.utmccn=(referral)|utmcsr=newsnetwork.adfox.ru|utmcct=/getCode|utmcmd=referral; ip: 10.10.0.58 host: - ident: - ident_u: - method: GET === Parse url: http://www.google-analytics.com/__utm.gif?utmwv=1&utmn=409209464&utmsr=1024x768&utmsc=16-bit&utmul=ru&utmje=1&utmfl=8.0&utmcn=1&utmdt=NEWSru.com :: %u041C%u0443%u0436%u0435%u0441%u0442%u0432%u0435%u043D%u043D%u043E%u0439 %u043A%u0438%u0442%u0430%u0439%u0441%u043A%u043E%u0439 %u0444%u0438%u0433%u0443%u0440%u0438%u0441%u0442%u043A%u0435 %u043F%u0440%u0435%u0434%u043F%u0438%u0441%u0430%u043D %u043F%u043E%u0441%u0442%u0435%u043B%u044C%u043D%u044B%u0439 %u0440%u0435%u0436%u0438%u043C&utmhn=newsru.com&utmr=http://newsnetwork.adfox.ru/getCode?p1=bh&p2=bn&p3=0&p4=a&pr=602437&utmp=/arch/sport/15feb2006/ch_girl.html&utmac=UA-129437-5&utmcc=__utma=60665394.286984764.1138012151.1138012151.1140533615.2;+__utmb=60665394;+__utmc=60665394;+__utmz=60665394.1140533615.2.2.utmccn=(referral)|utmcsr=newsnetwork.adfox.ru|utmcct=/getCode|utmcmd=referral; === protocol: http separator: 31 Symbol:/ (47) Look for hotlog.ru in (nil) list 2 level domen not found Look for hotlog.ru in 0x8057bdc list 2 level domen found in rule hotlog.ru http://127.0.0.1/ban/1x1.gif 10.10.0.58/- - GET